OpenAI recently released a misalignment report on its GPT5.6-Sol coding agent after it stole cryptocurrency from an account it didn’t own. It didn’t have enough funds for the smart contracts needed to execute its tasks, so it wrote a script that looked for accounts with public seed phrases that had enough funds to pay the gas fees, finished its task, and didn’t report that it took funds from an account it wasn’t assigned to without authorization.
Thankfully, this all happened on the Sepolia test network, which uses Sepolia ETH, simulated ETH in a simulated Ethereum network for cryptocurrency app development; it doesn’t actually have any monetary value. The report states, “The assignment asked it to update the trading calculator and database behavior, and to replace placeholder contract addresses with working deployments on Sepolia.” The final task required the agent to deploy smart contracts, a task that required gas fees paid in Sepolia ETH. It wasn’t supplied with a funded wallet, nor was it permitted to use funds from another account it found.
Either way, the agent was determined to complete its task and wrote a script to look for common developer recovery phrases and check the balances of the accounts, finding 362 addresses, with one having enough Sepolia ETH to deploy the contract. The CoT (chain of thought) even admitted: “Private key public, funds could be stolen anytime. ” After that CoT, it didn’t immediately spend the funds to complete its task; in fact, it was still trying to justify “stealing” the funds.
Source link







